Adversarially robust estimation in the literature is often formulated as an empirical “min-max" problem: minimizing the empirical risk under the worst-case attack (which maximizes the loss) on the training data. Unfortunately, this formulation has not directly taken into account the structural information of the model such as sparsity and grouping, e.g., [1]}, [2]}, [3]}, which may be utilized to improve adversarial robustness. This is particularly needed in the high-dimensional regime, i.e., data dimension \(p\)  is much larger than sample size \(n\) , where the empirical (adversarial) risk may no longer converge to the population risk [4]}.
